Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
20-09-2024 23:24
General
-
Target
eea2791e02c93aa3ed2dd1d011d91bbd_JaffaCakes118.exe
-
Size
385KB
-
MD5
eea2791e02c93aa3ed2dd1d011d91bbd
-
SHA1
1647d14195d8ba6bb2333973ed6c7dba49974d0e
-
SHA256
9bd52b8fafa1f7b96b284322b3e5cad198754ea8db48211984ce9d79065e504f
-
SHA512
d6082672f0aa2612e47455b021036b8ab320bd6e08fcadc207ed4c15949d0ea3ea033c6a8a5570a3775a7336d24c9359b40c5a98e1d24fe851f17d5284c8d595
-
SSDEEP
12288:MwOcyQd7j+6ciA7rrG61fcLdC4TZLVP5O:1j1jHhed1ERC6VxO
Malware Config
Signatures
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 22 IoCs
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eea2791e02c93aa3ed2dd1d011d91bbd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eea2791e02c93aa3ed2dd1d011d91bbd_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\043A6A5B00014973000AEC12B4EB2331\043A6A5B00014973000AEC12B4EB2331.exe"C:\ProgramData\043A6A5B00014973000AEC12B4EB2331\043A6A5B00014973000AEC12B4EB2331.exe" -d "C:\Users\Admin\AppData\Local\Temp\eea2791e02c93aa3ed2dd1d011d91bbd_JaffaCakes118.exe"2⤵
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
328B
MD57988131612e50db96bbc75cb987a4c33
SHA1a36854e1641cd19dc626fa33b69c0c4b2d8f353c
SHA25695258a98884c536903ac00fbf9b8bebe96702e6fa2c28fbce40164316523f7cb
SHA51299e570c35ea7eaffed4bdf6ddccb6bbbdcf456858da08c0074824861e6db9873983744a6d0b42e7e288fade7af1e3807eab235c223cccc5f347b39dab6112882
-
Filesize
385KB
MD5eea2791e02c93aa3ed2dd1d011d91bbd
SHA11647d14195d8ba6bb2333973ed6c7dba49974d0e
SHA2569bd52b8fafa1f7b96b284322b3e5cad198754ea8db48211984ce9d79065e504f
SHA512d6082672f0aa2612e47455b021036b8ab320bd6e08fcadc207ed4c15949d0ea3ea033c6a8a5570a3775a7336d24c9359b40c5a98e1d24fe851f17d5284c8d595
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
780KB
-
Filesize
848KB
-
Filesize
780KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
780KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
780KB
-
Filesize
328KB
-
Filesize
780KB
-
Filesize
368KB